shadow-maint/shadow 4.20.0

4.20.0: Ibores

on GitHub

shadow-4.20.0 (Ibores) - shadow utils

Breaking changes:

• Removals:

  The following programs and features were deprecated in 4.19 (Herve)
  or earlier, and have been removed in 4.20.

  • expiry(1) (deprecated in 4.19)

    See #1481
    and #1432.

  • login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19)

    See #1456.

  • login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19)

    See #1457.

  • login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around)

    See #1455.

  • shadow(5): .sp_min (deprecated in 4.19)

    See #1482.

    This also includes the following removals:

    • chage(1): -m,--mindays (also the interactive version)
    • passwd(1): -n,--mindays
    • login.defs(5): PASS_MIN_DAYS

    This feature is considered a vulnerability, and was removed
    without replacement.

    Programs will now fail when any of those flags or variable are
    specified. This is intentional, and should help identify any
    scripts that rely on these.

  • groupmems(8) (deprecated in 4.19)

    See #1343
    and #1601.

    Use usermod(8) instead.

  • logoutd(8) (deprecated in 4.19)

    See #999
    and #1344.

• Defaults:

  The following default values were changed.

  • login.defs(5): Remove defaults for password expiration
    (PASS_MAX_DAYS, PASS_WARN_AGE)

    See #1428.

  • login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES)

    See #1278
    and #1454.

    Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES.

• Features

  The following features that were optional in 4.19 are now
  unconditionally supported in 4.20.

  • SHA256, SHA512

    See #1278
    and #1452.

Dependencies:

• We've removed an unused dependency (libattr).
  See #1473.

Deprecations

No new deprecations since 4.19. However, we maintain the
deprecations from then. Here's a reminder of deprecated features
that have not been removed yet (they will eventually be removed):

• Password aging:

  • chage(1):
    -I,--inactive (also the interactive version)
    -M,--maxdays (also the interactive version)
    -W,--warndays (also the interactive version)
  • passwd(1):
    -k,--keep-tokens
    -x,--maxdays
    -i,--inactive
    -w,--warndays
  • useradd(8):
    -f,--inactive
  • usermod(8):
    -f,--inactive
  • login.defs(5):
    PASS_MAX_DAYS
    PASS_WARN_AGE
  • /etc/default/useradd:
    INACTIVE
  • shadow(5):
    .sp_lstchg: Restrict to just the values 0 and empty.
    .sp_max
    .sp_warn
    .sp_inact

Binary tarballs produced and signed with:

$ ./autogen.sh 
$ make -j4
$ make dist
$ gpg --detach-sign --armor shadow-4.20.0.tar.gz 
$ gpg --detach-sign --armor shadow-4.20.0.tar.xz

Source tarballs produced and signed with:

$ git archive -o shadow-4.20.0_src.tar 4.20.0
$ gpg --detach-sign --armor shadow-4.20.0_src.tar 
$ gzip -nk shadow-4.20.0_src.tar
$ xz -k shadow-4.20.0_src.tar